The CFPayment library allows an empty CVV2 value to be posted to Stripe, but Stripe requires that the parameter not be passed if it's not being used. Excluding setVerificationValue() still caused an empty value to be set and passed. I added the following logic to api/gateway/base.cfc in order to exclude the empty parameter from being passed.
<CFIF NOT Findnocase("cvc", key) OR (Findnocase("cvc", key) AND LEN(trim(arguments.payload[key])))>
<!--- CFHTTParam --->
</CFIF>